grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/cipher/derive_key.cc

@@ -20,12 +20,9 @@
 #include <openssl/mem.h>
 
 
-#define PKCS5_SALT_LEN 8
-
 int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
-                   const uint8_t *salt, const uint8_t *data, size_t data_len,
+                   const uint8_t salt[8], const uint8_t *data, size_t data_len,
                    unsigned count, uint8_t *key, uint8_t *iv) {
-  EVP_MD_CTX c;
   uint8_t md_buf[EVP_MAX_MD_SIZE];
   unsigned addmd = 0;
   unsigned mds = 0, i;
@@ -37,36 +34,36 @@ int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
   assert(nkey <= EVP_MAX_KEY_LENGTH);
   assert(niv <= EVP_MAX_IV_LENGTH);
 
-  if (data == NULL) {
+  if (data == nullptr) {
     return nkey;
   }
 
-  EVP_MD_CTX_init(&c);
+  bssl::ScopedEVP_MD_CTX c;
   for (;;) {
-    if (!EVP_DigestInit_ex(&c, md, NULL)) {
+    if (!EVP_DigestInit_ex(c.get(), md, nullptr)) {
       goto err;
     }
     if (addmd++) {
-      if (!EVP_DigestUpdate(&c, md_buf, mds)) {
+      if (!EVP_DigestUpdate(c.get(), md_buf, mds)) {
         goto err;
       }
     }
-    if (!EVP_DigestUpdate(&c, data, data_len)) {
+    if (!EVP_DigestUpdate(c.get(), data, data_len)) {
       goto err;
     }
-    if (salt != NULL) {
-      if (!EVP_DigestUpdate(&c, salt, PKCS5_SALT_LEN)) {
+    if (salt != nullptr) {
+      if (!EVP_DigestUpdate(c.get(), salt, 8)) {
         goto err;
       }
     }
-    if (!EVP_DigestFinal_ex(&c, md_buf, &mds)) {
+    if (!EVP_DigestFinal_ex(c.get(), md_buf, &mds)) {
       goto err;
     }
 
     for (i = 1; i < count; i++) {
-      if (!EVP_DigestInit_ex(&c, md, NULL) ||
-          !EVP_DigestUpdate(&c, md_buf, mds) ||
-          !EVP_DigestFinal_ex(&c, md_buf, &mds)) {
+      if (!EVP_DigestInit_ex(c.get(), md, nullptr) ||
+          !EVP_DigestUpdate(c.get(), md_buf, mds) ||
+          !EVP_DigestFinal_ex(c.get(), md_buf, &mds)) {
         goto err;
       }
     }
@@ -77,7 +74,7 @@ int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
         if (nkey == 0 || i == mds) {
           break;
         }
-        if (key != NULL) {
+        if (key != nullptr) {
           *(key++) = md_buf[i];
         }
         nkey--;
@@ -90,7 +87,7 @@ int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
         if (niv == 0 || i == mds) {
           break;
         }
-        if (iv != NULL) {
+        if (iv != nullptr) {
           *(iv++) = md_buf[i];
         }
         niv--;
@@ -104,7 +101,6 @@ int EVP_BytesToKey(const EVP_CIPHER *type, const EVP_MD *md,
   rv = EVP_CIPHER_key_length(type);
 
 err:
-  EVP_MD_CTX_cleanup(&c);
   OPENSSL_cleanse(md_buf, EVP_MAX_MD_SIZE);
   return rv;
 }

data/third_party/boringssl-with-bazel/crypto/cipher/e_aesctrhmac.cc

@@ -19,12 +19,15 @@
 #include <openssl/cipher.h>
 #include <openssl/crypto.h>
 #include <openssl/err.h>
-#include <openssl/sha.h>
+#include <openssl/sha2.h>
+#include <openssl/span.h>
 
 #include "../fipsmodule/aes/internal.h"
 #include "../fipsmodule/cipher/internal.h"
 
 
+using namespace bssl;
+
 #define EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN SHA256_DIGEST_LENGTH
 #define EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN 12
 
@@ -39,7 +42,7 @@ struct aead_aes_ctr_hmac_sha256_ctx {
   SHA256_CTX outer_init_state;
 };
 
-static_assert(sizeof(((EVP_AEAD_CTX *)NULL)->state) >=
+static_assert(sizeof(((EVP_AEAD_CTX *)nullptr)->state) >=
                   sizeof(struct aead_aes_ctr_hmac_sha256_ctx),
               "AEAD state is too small");
 static_assert(alignof(union evp_aead_ctx_st_state) >=
@@ -96,8 +99,8 @@ static int aead_aes_ctr_hmac_sha256_init(EVP_AEAD_CTX *ctx, const uint8_t *key,
     return 0;
   }
 
-  aes_ctx->ctr =
-      aes_ctr_set_key(&aes_ctx->ks.ks, NULL, &aes_ctx->block, key, aes_key_len);
+  aes_ctx->ctr = aes_ctr_set_key(&aes_ctx->ks.ks, nullptr, &aes_ctx->block, key,
+                                 aes_key_len);
   ctx->tag_len = tag_len;
   hmac_init(&aes_ctx->inner_init_state, &aes_ctx->outer_init_state,
             key + aes_key_len);
@@ -121,19 +124,22 @@ static void hmac_update_uint64(SHA256_CTX *sha256, uint64_t value) {
 static void hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH],
                            const SHA256_CTX *inner_init_state,
                            const SHA256_CTX *outer_init_state,
-                           const uint8_t *ad, size_t ad_len,
-                           const uint8_t *nonce, const uint8_t *ciphertext,
-                           size_t ciphertext_len) {
+                           Span<const CRYPTO_IVEC> aadvecs,
+                           const uint8_t *nonce,
+                           Span<const CRYPTO_IOVEC> iovecs, bool encrypt) {
+  size_t ad_len = bssl::iovec::TotalLength(aadvecs);
   SHA256_CTX sha256;
   OPENSSL_memcpy(&sha256, inner_init_state, sizeof(sha256));
   hmac_update_uint64(&sha256, ad_len);
-  hmac_update_uint64(&sha256, ciphertext_len);
+  hmac_update_uint64(&sha256, bssl::iovec::TotalLength(iovecs));
   SHA256_Update(&sha256, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN);
-  SHA256_Update(&sha256, ad, ad_len);
+  for (const CRYPTO_IVEC &aadvec : aadvecs) {
+    SHA256_Update(&sha256, aadvec.in, aadvec.len);
+  }
 
   // Pad with zeros to the end of the SHA-256 block.
   const unsigned num_padding =
-      (SHA256_CBLOCK - ((sizeof(uint64_t)*2 +
+      (SHA256_CBLOCK - ((sizeof(uint64_t) * 2 +
                          EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN + ad_len) %
                         SHA256_CBLOCK)) %
       SHA256_CBLOCK;
@@ -141,7 +147,9 @@ static void hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH],
   OPENSSL_memset(padding, 0, num_padding);
   SHA256_Update(&sha256, padding, num_padding);
 
-  SHA256_Update(&sha256, ciphertext, ciphertext_len);
+  for (const CRYPTO_IOVEC &iovec : iovecs) {
+    SHA256_Update(&sha256, encrypt ? iovec.out : iovec.in, iovec.len);
+  }
 
   uint8_t inner_digest[SHA256_DIGEST_LENGTH];
   SHA256_Final(inner_digest, &sha256);
@@ -152,10 +160,8 @@ static void hmac_calculate(uint8_t out[SHA256_DIGEST_LENGTH],
 }
 
 static void aead_aes_ctr_hmac_sha256_crypt(
-    const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx, uint8_t *out,
-    const uint8_t *in, size_t len, const uint8_t *nonce) {
-  // Since the AEAD operation is one-shot, keeping a buffer of unused keystream
-  // bytes is pointless. However, |CRYPTO_ctr128_encrypt_ctr32| requires it.
+    const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx,
+    Span<const CRYPTO_IOVEC> iovecs, const uint8_t *nonce) {
   uint8_t partial_block_buffer[AES_BLOCK_SIZE];
   unsigned partial_block_offset = 0;
   OPENSSL_memset(partial_block_buffer, 0, sizeof(partial_block_buffer));
@@ -164,74 +170,85 @@ static void aead_aes_ctr_hmac_sha256_crypt(
   OPENSSL_memcpy(counter, nonce, EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN);
   OPENSSL_memset(counter + EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN, 0, 4);
 
-  CRYPTO_ctr128_encrypt_ctr32(in, out, len, &aes_ctx->ks.ks, counter,
-                              partial_block_buffer, &partial_block_offset,
-                              aes_ctx->ctr);
+  for (const CRYPTO_IOVEC &iovec : iovecs) {
+    CRYPTO_ctr128_encrypt_ctr32(iovec.in, iovec.out, iovec.len, &aes_ctx->ks.ks,
+                                counter, partial_block_buffer,
+                                &partial_block_offset, aes_ctx->ctr);
+  }
 }
 
-static int aead_aes_ctr_hmac_sha256_seal_scatter(
-    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
-    size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
-    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
+static int aead_aes_ctr_hmac_sha256_sealv(const EVP_AEAD_CTX *ctx,
+                                          Span<const CRYPTO_IOVEC> iovecs,
+                                          Span<uint8_t> out_tag,
+                                          size_t *out_tag_len,
+                                          Span<const uint8_t> nonce,
+                                          Span<const CRYPTO_IVEC> aadvecs) {
   const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx =
-      (struct aead_aes_ctr_hmac_sha256_ctx *) &ctx->state;
-  const uint64_t in_len_64 = in_len;
+      (struct aead_aes_ctr_hmac_sha256_ctx *)&ctx->state;
+  const uint64_t in_len_64 = bssl::iovec::TotalLength(iovecs);
 
   if (in_len_64 >= (UINT64_C(1) << 32) * AES_BLOCK_SIZE) {
-     // This input is so large it would overflow the 32-bit block counter.
+    // This input is so large it would overflow the 32-bit block counter.
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
     return 0;
   }
 
-  if (max_out_tag_len < ctx->tag_len) {
+  if (out_tag.size() < ctx->tag_len) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
     return 0;
   }
 
-  if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
+  if (nonce.size() != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
     return 0;
   }
 
-  aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce);
+  aead_aes_ctr_hmac_sha256_crypt(aes_ctx, iovecs, nonce.data());
 
   uint8_t hmac_result[SHA256_DIGEST_LENGTH];
   hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
-                 &aes_ctx->outer_init_state, ad, ad_len, nonce, out, in_len);
-  OPENSSL_memcpy(out_tag, hmac_result, ctx->tag_len);
+                 &aes_ctx->outer_init_state, aadvecs, nonce.data(), iovecs,
+                 /*encrypt=*/true);
+  CopyToPrefix(Span(hmac_result).first(ctx->tag_len), out_tag);
   *out_tag_len = ctx->tag_len;
 
   return 1;
 }
 
-static int aead_aes_ctr_hmac_sha256_open_gather(
-    const EVP_AEAD_CTX *ctx, uint8_t *out, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *in_tag,
-    size_t in_tag_len, const uint8_t *ad, size_t ad_len) {
+static int aead_aes_ctr_hmac_sha256_openv_detached(
+    const EVP_AEAD_CTX *ctx, Span<const CRYPTO_IOVEC> iovecs,
+    Span<const uint8_t> nonce, Span<const uint8_t> in_tag,
+    Span<const CRYPTO_IVEC> aadvecs) {
   const struct aead_aes_ctr_hmac_sha256_ctx *aes_ctx =
-      (struct aead_aes_ctr_hmac_sha256_ctx *) &ctx->state;
+      (struct aead_aes_ctr_hmac_sha256_ctx *)&ctx->state;
+  const uint64_t in_len_64 = bssl::iovec::TotalLength(iovecs);
+
+  if (in_len_64 >= (UINT64_C(1) << 32) * AES_BLOCK_SIZE) {
+    // This input is so large it would overflow the 32-bit block counter.
+    OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
+    return 0;
+  }
 
-  if (in_tag_len != ctx->tag_len) {
+  if (in_tag.size() != ctx->tag_len) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
     return 0;
   }
 
-  if (nonce_len != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
+  if (nonce.size() != EVP_AEAD_AES_CTR_HMAC_SHA256_NONCE_LEN) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
     return 0;
   }
 
   uint8_t hmac_result[SHA256_DIGEST_LENGTH];
   hmac_calculate(hmac_result, &aes_ctx->inner_init_state,
-                 &aes_ctx->outer_init_state, ad, ad_len, nonce, in,
-                 in_len);
-  if (CRYPTO_memcmp(hmac_result, in_tag, ctx->tag_len) != 0) {
+                 &aes_ctx->outer_init_state, aadvecs, nonce.data(), iovecs,
+                 /*encrypt=*/false);
+  if (CRYPTO_memcmp(hmac_result, in_tag.data(), ctx->tag_len) != 0) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
     return 0;
   }
 
-  aead_aes_ctr_hmac_sha256_crypt(aes_ctx, out, in, in_len, nonce);
+  aead_aes_ctr_hmac_sha256_crypt(aes_ctx, iovecs, nonce.data());
 
   return 1;
 }
@@ -241,16 +258,15 @@ static const EVP_AEAD aead_aes_128_ctr_hmac_sha256 = {
     12,                                    // nonce length
     EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // overhead
     EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // max tag length
-    0,                                     // seal_scatter_supports_extra_in
 
     aead_aes_ctr_hmac_sha256_init,
-    NULL /* init_with_direction */,
+    nullptr /* init_with_direction */,
     aead_aes_ctr_hmac_sha256_cleanup,
-    NULL /* open */,
-    aead_aes_ctr_hmac_sha256_seal_scatter,
-    aead_aes_ctr_hmac_sha256_open_gather,
-    NULL /* get_iv */,
-    NULL /* tag_len */,
+    nullptr /* openv */,
+    aead_aes_ctr_hmac_sha256_sealv,
+    aead_aes_ctr_hmac_sha256_openv_detached,
+    nullptr /* get_iv */,
+    nullptr /* tag_len */,
 };
 
 static const EVP_AEAD aead_aes_256_ctr_hmac_sha256 = {
@@ -258,22 +274,21 @@ static const EVP_AEAD aead_aes_256_ctr_hmac_sha256 = {
     12,                                    // nonce length
     EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // overhead
     EVP_AEAD_AES_CTR_HMAC_SHA256_TAG_LEN,  // max tag length
-    0,                                     // seal_scatter_supports_extra_in
 
     aead_aes_ctr_hmac_sha256_init,
-    NULL /* init_with_direction */,
+    nullptr /* init_with_direction */,
     aead_aes_ctr_hmac_sha256_cleanup,
-    NULL /* open */,
-    aead_aes_ctr_hmac_sha256_seal_scatter,
-    aead_aes_ctr_hmac_sha256_open_gather,
-    NULL /* get_iv */,
-    NULL /* tag_len */,
+    nullptr /* openv */,
+    aead_aes_ctr_hmac_sha256_sealv,
+    aead_aes_ctr_hmac_sha256_openv_detached,
+    nullptr /* get_iv */,
+    nullptr /* tag_len */,
 };
 
-const EVP_AEAD *EVP_aead_aes_128_ctr_hmac_sha256(void) {
+const EVP_AEAD *EVP_aead_aes_128_ctr_hmac_sha256() {
   return &aead_aes_128_ctr_hmac_sha256;
 }
 
-const EVP_AEAD *EVP_aead_aes_256_ctr_hmac_sha256(void) {
+const EVP_AEAD *EVP_aead_aes_256_ctr_hmac_sha256() {
   return &aead_aes_256_ctr_hmac_sha256;
 }

data/third_party/boringssl-with-bazel/crypto/cipher/e_aeseax.cc

@@ -25,10 +25,14 @@
 #include <openssl/crypto.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
+#include <openssl/span.h>
 
 #include "../fipsmodule/cipher/internal.h"
 #include "../internal.h"
 
+
+using namespace bssl;
+
 // Implementation of AES-EAX defined in
 // https://www.iacr.org/archive/fse2004/30170391/30170391.pdf.
 
@@ -114,9 +118,13 @@ static void pad(const struct aead_aes_eax_ctx *aes_ctx,
   CRYPTO_xor16(out, aes_ctx->p, out);
 }
 
-static void omac(const struct aead_aes_eax_ctx *aes_ctx,
-                 uint8_t out[AES_BLOCK_SIZE], const uint8_t *in,
-                 size_t in_len) {
+template <typename IVEC>
+static void omac_with_tag(const struct aead_aes_eax_ctx *aes_ctx,
+                          uint8_t out[AES_BLOCK_SIZE], Span<const IVEC> ivecs,
+                          uint8_t tag) {
+  OPENSSL_memset(out, 0, AES_BLOCK_SIZE);
+  out[AES_BLOCK_SIZE - 1] = tag;
+  size_t in_len = bssl::iovec::TotalLength(ivecs);
   if (in_len == 0) {
     // CBK(pad(M;B,P)) = CBK(B). Avoiding padding to skip a copy.
     cbk_block(aes_ctx, aes_ctx->b, out);
@@ -124,55 +132,106 @@ static void omac(const struct aead_aes_eax_ctx *aes_ctx,
   }
   // CBK(M1) = Ek(M1 ^ 0^n)
   AES_encrypt(out, out, &aes_ctx->ks.ks);
-  while (in_len > AES_BLOCK_SIZE) {
-    // Full blocks, no padding needed.
-    cbk_block(aes_ctx, in, out);
-    in += AES_BLOCK_SIZE;
-    in_len -= AES_BLOCK_SIZE;
-  }
-  // Last block to be padded.
-  uint8_t padded_block[AES_BLOCK_SIZE];
-  pad(aes_ctx, padded_block, in, in_len);
-  cbk_block(aes_ctx, padded_block, out);
+  bssl::iovec::ForEachBlockRange<AES_BLOCK_SIZE>(
+      ivecs,
+      [&](const uint8_t *in, size_t len) {
+        while (len >= AES_BLOCK_SIZE) {
+          // Full blocks, no padding needed.
+          cbk_block(aes_ctx, in, out);
+          in += AES_BLOCK_SIZE;
+          len -= AES_BLOCK_SIZE;
+        }
+        BSSL_CHECK(len == 0);
+        return true;
+      },
+      [&](const uint8_t *in, size_t len) {
+        // Remaining blocks.
+        while (len > AES_BLOCK_SIZE) {
+          // Full blocks, no padding needed.
+          cbk_block(aes_ctx, in, out);
+          in += AES_BLOCK_SIZE;
+          len -= AES_BLOCK_SIZE;
+        }
+        // Last partial block.
+        uint8_t padded_block[AES_BLOCK_SIZE];
+        pad(aes_ctx, padded_block, in, len);
+        cbk_block(aes_ctx, padded_block, out);
+        return true;
+      });
 }
 
-static void omac_with_tag(const struct aead_aes_eax_ctx *aes_ctx,
-                          uint8_t out[AES_BLOCK_SIZE], const uint8_t *in,
-                          size_t in_len, int tag) {
+static void omac_with_tag_iovec_out(const struct aead_aes_eax_ctx *aes_ctx,
+                                    uint8_t out[AES_BLOCK_SIZE],
+                                    Span<const CRYPTO_IOVEC> iovecs,
+                                    uint8_t tag) {
   OPENSSL_memset(out, 0, AES_BLOCK_SIZE);
   out[AES_BLOCK_SIZE - 1] = tag;
-  omac(aes_ctx, out, in, in_len);
+  size_t in_len = bssl::iovec::TotalLength(iovecs);
+  if (in_len == 0) {
+    // CBK(pad(M;B,P)) = CBK(B). Avoiding padding to skip a copy.
+    cbk_block(aes_ctx, aes_ctx->b, out);
+    return;
+  }
+  // CBK(M1) = Ek(M1 ^ 0^n)
+  AES_encrypt(out, out, &aes_ctx->ks.ks);
+  bssl::iovec::ForEachOutBlockRange<AES_BLOCK_SIZE>(
+      iovecs,
+      [&](const uint8_t *in, size_t len) {
+        while (len >= AES_BLOCK_SIZE) {
+          // Full blocks, no padding needed.
+          cbk_block(aes_ctx, in, out);
+          in += AES_BLOCK_SIZE;
+          len -= AES_BLOCK_SIZE;
+        }
+        BSSL_CHECK(len == 0);
+        return true;
+      },
+      [&](const uint8_t *in, size_t len) {
+        while (len > AES_BLOCK_SIZE) {
+          // Full blocks, no padding needed.
+          cbk_block(aes_ctx, in, out);
+          in += AES_BLOCK_SIZE;
+          len -= AES_BLOCK_SIZE;
+        }
+        // Last partial block.
+        uint8_t padded_block[AES_BLOCK_SIZE];
+        pad(aes_ctx, padded_block, in, len);
+        cbk_block(aes_ctx, padded_block, out);
+        return true;
+      });
 }
 
-// Encrypts/decrypts |in_len| bytes from |in| to |out| using AES-CTR with |n| as
+// Encrypts/decrypts `in_len` bytes from `in` to `out` using AES-CTR with `n` as
 // the IV.
-static void aes_ctr(const struct aead_aes_eax_ctx *aes_ctx, uint8_t *out,
-                    const uint8_t n[AES_BLOCK_SIZE], const uint8_t *in,
-                    size_t in_len) {
+static void aes_ctr(const struct aead_aes_eax_ctx *aes_ctx,
+                    Span<const CRYPTO_IOVEC> iovecs,
+                    const uint8_t n[AES_BLOCK_SIZE]) {
   uint8_t ivec[AES_BLOCK_SIZE];
   OPENSSL_memcpy(ivec, n, AES_BLOCK_SIZE);
 
-  uint8_t unused_ecount_buf[AES_BLOCK_SIZE];
-  unsigned int unused_num = 0;
-  AES_ctr128_encrypt(in, out, in_len, &aes_ctx->ks.ks, ivec, unused_ecount_buf,
-                     &unused_num);
+  uint8_t ecount_buf[AES_BLOCK_SIZE];
+  unsigned int num = 0;
+
+  for (const CRYPTO_IOVEC &iovec : iovecs) {
+    AES_ctr128_encrypt(iovec.in, iovec.out, iovec.len, &aes_ctx->ks.ks, ivec,
+                       ecount_buf, &num);
+  }
 }
 
-static int aead_aes_eax_seal_scatter(
-    const EVP_AEAD_CTX *ctx, uint8_t *out, uint8_t *out_tag,
-    size_t *out_tag_len, size_t max_out_tag_len, const uint8_t *nonce,
-    size_t nonce_len, const uint8_t *in, size_t in_len, const uint8_t *extra_in,
-    size_t extra_in_len, const uint8_t *ad, size_t ad_len) {
-  assert(extra_in_len == 0);
+static int aead_aes_eax_sealv(const EVP_AEAD_CTX *ctx,
+                              Span<const CRYPTO_IOVEC> iovecs,
+                              Span<uint8_t> out_tag, size_t *out_tag_len,
+                              Span<const uint8_t> nonce,
+                              Span<const CRYPTO_IVEC> aadvecs) {
   // We use the full 128 bits of the nonce as counter, so no need to check the
   // plaintext size.
 
-  if (max_out_tag_len < ctx->tag_len) {
+  if (out_tag.size() < ctx->tag_len) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BUFFER_TOO_SMALL);
     return 0;
   }
 
-  if (nonce_len != 12 && nonce_len != 16) {
+  if (nonce.size() != 12 && nonce.size() != 16) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
     return 0;
   }
@@ -182,43 +241,44 @@ static int aead_aes_eax_seal_scatter(
 
   // N <- OMAC(0 || nonce)
   uint8_t n[AES_BLOCK_SIZE];
-  omac_with_tag(aes_ctx, n, nonce, nonce_len, /*tag=*/0);
+  CRYPTO_IVEC noncevec[1];
+  noncevec[0].in = nonce.data();
+  noncevec[0].len = nonce.size();
+  omac_with_tag(aes_ctx, n, Span<const CRYPTO_IVEC>(noncevec), /*tag=*/0);
   // H <- OMAC(1 || ad)
   uint8_t h[AES_BLOCK_SIZE];
-  omac_with_tag(aes_ctx, h, ad, ad_len, /*tag=*/1);
+  omac_with_tag(aes_ctx, h, aadvecs, /*tag=*/1);
 
   // C <- CTR^{N}_{K}(M)
-  aes_ctr(aes_ctx, out, n, in, in_len);
+  aes_ctr(aes_ctx, iovecs, n);
 
   // MAC <- OMAC(2 || C)
-  omac_with_tag(aes_ctx, out_tag, out, in_len, /*tag=*/2);
+  omac_with_tag_iovec_out(aes_ctx, out_tag.data(), iovecs, /*tag=*/2);
   // MAC <- N ^ C ^ H
-  CRYPTO_xor16(out_tag, n, out_tag);
-  CRYPTO_xor16(out_tag, h, out_tag);
+  CRYPTO_xor16(out_tag.data(), n, out_tag.data());
+  CRYPTO_xor16(out_tag.data(), h, out_tag.data());
 
   *out_tag_len = ctx->tag_len;
   return 1;
 }
 
-static int aead_aes_eax_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
-                                    const uint8_t *nonce, size_t nonce_len,
-                                    const uint8_t *in, size_t in_len,
-                                    const uint8_t *in_tag, size_t in_tag_len,
-                                    const uint8_t *ad, size_t ad_len) {
-  const uint64_t ad_len_64 = ad_len;
+static int aead_aes_eax_openv_detached(const EVP_AEAD_CTX *ctx,
+                                       Span<const CRYPTO_IOVEC> iovecs,
+                                       Span<const uint8_t> nonce,
+                                       Span<const uint8_t> in_tag,
+                                       Span<const CRYPTO_IVEC> aadvecs) {
+  const uint64_t ad_len_64 = bssl::iovec::TotalLength(aadvecs);
   if (ad_len_64 >= (UINT64_C(1) << 61)) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_TOO_LARGE);
     return 0;
   }
 
-  const uint64_t in_len_64 = in_len;
-  if (in_tag_len != EVP_AEAD_AES_EAX_TAG_LEN ||
-      in_len_64 > (UINT64_C(1) << 36) + AES_BLOCK_SIZE) {
+  if (in_tag.size() != EVP_AEAD_AES_EAX_TAG_LEN) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
     return 0;
   }
 
-  if (nonce_len != 12 && nonce_len != 16) {
+  if (nonce.size() != 12 && nonce.size() != 16) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_NONCE_SIZE);
     return 0;
   }
@@ -228,25 +288,29 @@ static int aead_aes_eax_open_gather(const EVP_AEAD_CTX *ctx, uint8_t *out,
 
   // N <- OMAC(0 || nonce)
   uint8_t n[AES_BLOCK_SIZE];
-  omac_with_tag(aes_ctx, n, nonce, nonce_len, /*tag=*/0);
+  CRYPTO_IVEC noncevec[1];
+  noncevec[0].in = nonce.data();
+  noncevec[0].len = nonce.size();
+  omac_with_tag(aes_ctx, n, Span<const CRYPTO_IVEC>(noncevec),
+                /*tag=*/0);
   // H <- OMAC(1 || ad)
   uint8_t h[AES_BLOCK_SIZE];
-  omac_with_tag(aes_ctx, h, ad, ad_len, /*tag=*/1);
+  omac_with_tag(aes_ctx, h, aadvecs, /*tag=*/1);
 
   // MAC <- OMAC(2 || C)
   uint8_t mac[AES_BLOCK_SIZE];
-  omac_with_tag(aes_ctx, mac, in, in_len, /*tag=*/2);
+  omac_with_tag(aes_ctx, mac, iovecs, /*tag=*/2);
   // MAC <- N ^ C ^ H
   CRYPTO_xor16(mac, n, mac);
   CRYPTO_xor16(mac, h, mac);
 
-  if (CRYPTO_memcmp(mac, in_tag, in_tag_len) != 0) {
+  if (CRYPTO_memcmp(mac, in_tag.data(), in_tag.size()) != 0) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
     return 0;
   }
 
   // M <- CTR^{N}_{K}(C)
-  aes_ctr(aes_ctx, out, n, in, in_len);
+  aes_ctr(aes_ctx, iovecs, n);
   return 1;
 }
 
@@ -255,16 +319,15 @@ static const EVP_AEAD aead_aes_128_eax = {
     16,                        // nonce length
     EVP_AEAD_AES_EAX_TAG_LEN,  // overhead
     EVP_AEAD_AES_EAX_TAG_LEN,  // max tag length
-    0,                         // seal_scatter_supports_extra_in
 
     aead_aes_eax_init,
-    NULL,  // init_with_direction
+    nullptr,  // init_with_direction
     aead_aes_eax_cleanup,
-    NULL,  // open
-    aead_aes_eax_seal_scatter,
-    aead_aes_eax_open_gather,
-    NULL,  // get_iv
-    NULL,  // tag_len
+    nullptr,  // openv
+    aead_aes_eax_sealv,
+    aead_aes_eax_openv_detached,
+    nullptr,  // get_iv
+    nullptr,  // tag_len
 };
 
 static const EVP_AEAD aead_aes_256_eax = {
@@ -272,18 +335,17 @@ static const EVP_AEAD aead_aes_256_eax = {
     16,                        // nonce length
     EVP_AEAD_AES_EAX_TAG_LEN,  // overhead
     EVP_AEAD_AES_EAX_TAG_LEN,  // max tag length
-    0,                         // seal_scatter_supports_extra_in
 
     aead_aes_eax_init,
-    NULL,  // init_with_direction
+    nullptr,  // init_with_direction
     aead_aes_eax_cleanup,
-    NULL,  // open
-    aead_aes_eax_seal_scatter,
-    aead_aes_eax_open_gather,
-    NULL,  // get_iv
-    NULL,  // tag_len
+    nullptr,  // openv
+    aead_aes_eax_sealv,
+    aead_aes_eax_openv_detached,
+    nullptr,  // get_iv
+    nullptr,  // tag_len
 };
 
-const EVP_AEAD *EVP_aead_aes_128_eax(void) { return &aead_aes_128_eax; }
+const EVP_AEAD *EVP_aead_aes_128_eax() { return &aead_aes_128_eax; }
 
-const EVP_AEAD *EVP_aead_aes_256_eax(void) { return &aead_aes_256_eax; }
+const EVP_AEAD *EVP_aead_aes_256_eax() { return &aead_aes_256_eax; }